HELP!!! Avira Found Malware on WRSA.exe

My Avira Free AV detects malware on WRSA.EXE. What should I do? Right now Avira is asking me to move to quarantine the WRSA.EXE, do i need to click yes and apply? Please advice. TIA

http://k.min.us/jbX9Tq.jpg

 

Report to Avira that it is a False Positive! But don't let Avira remove the WRSA.exe files!

HTH,

TH

 

I have paid Prevx3 and that identified the beta as malware as well!
I reported it.

 

How can that be possible you can't run Prevx 3 and WRSA at the same time? Or are you talking about the install file?

TH

 

Thanks. I already submitted wrsa.exe to avira and its "Under Analysis".
Hope they can reply since Avira now is always asking me to remove wrsa.exe.

 

This will always happen during the Beta testing some other AV will detect WRSA as malware!

See this post: https://www.wilderssecurity.com/showpost.php?p=1891425&postcount=67

TH

 

I forgot to tell you that there were 2 files detected by avira, aside from wrsa.exe it also detected WRusr.dll as malware.

Does WRusr.dll belongs to Webroot?

 

Yes it does and FP also!

TH

 

Thank you for your prompt reply.

anyhow, this is what avira site said about WRusr.dll

 

But it's still a FP and don't let Avira remove those files! PrevxHelp will give us more info!

TH

 

Thanks again!

I emailed back Avira and explained to them that those 2 files belong to WebRoot Secure Anywhere Beta.

 

Your Welcome please let us know how it goes!

TH

 

Update:

Avira just replied about my inquiry about wrsa.exe & wrusr.dll, and here is what they have to say...

http://analysis.avira.com/samples/d...Ppjv821TrckZVA10srbDvfkhLgJ&incidentid=790770

 

Great thank you!

TH

 

For what it's worth, the file "wrkrn.sys" is also a Webroot file

Thanks!

 

I can't find that file on Win 7 x64

TH

 

It is the deep level driver (it also boots up in Safe Mode for example), should be in system32/drivers I guess.

 

Thanks a simple search didn't find it but a search of System32 did!

TH

 

I meant the install file.

 

It will be under the actual C:\Windows\System32\Drivers\ folder - it is a native 64bit driver (you might be browsing under C:\Windows\Syswow64\drivers\ which is where 32bit applications would write).

 

I have found it thanks Joe!

Daniel